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ABSTRACT 


In this report are reviews of techniques for detecting and verifying 
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SECTION I 
INTRODUCTION 


A. TYPES OF HAZARDS 

Launching a liquid propelled rocket is hazardous because of the copious quantities 
of propellants it carries. Propellant hazards can be classified into two main categories: 
(1) those affecting personnel (2) those affecting hardware. Hazards affecting personnel 
may be classed as those of toxicity, suffocation, and fire and explosion. 

B. TOXIC GASES AND SUFFOCANTS 

Toxic propellants of specific interest to NASA are nitrogen tetroxide, elemental 
fluorine, and the hydrazines; such as, hydrazine, monomenthylhydrazine, and unsymme- 
trical dimethy I hydrazine. Of these, only hydrazine base propellants present fire and 
blast hazards, while all of them present dermal and respiratory hazards. In enclosed, 
inhabited spaces, there exists the possibility of anoxia from dilution of atmospheric 
oxygen by leakage of high pressure helium and nitrogen. 

Each hazard requires a different detection subsystem, since it is impossible for a 
single detector to operate satisfactorily in many different atmospheres. 

C. MALFUNCTION CHARACTERISTICS 

Many failure modes are possible at a launch or test facility. Except for uncontroll- 
able abort, all failure modes are qualitatively, if not quantitatively, similar. Typical 
propellant rrialfunction characteristics of rocket ground support equipment (GSE) are listed 
following: 

1 . Location - point external sources 

2. Location - single point failure 

3. Gas concentrations - wide range 

4. Gas concentrations - rapid fluctuations 

5. Time release pattern - discontinuous or sporadic 

6. Phases - gas or liquid, present simultaneously 

7 . Temperatures - wide range of release 

Experience with both ballistic weapons and manned space vehicles has shown that 
the majority of accidental releases of toxic liquids and gas^s occurs during active pro- 
pellant transfer and flow operations. The probability of r pellant release following its 
transfer is quite low until the vehicle tanks are pressurize prior to flight. The majority 
of recorded flight-weight hardware malfunctions are single point failures such as fitting, 
point, and seal leaks. The leak or spill probability from a passive ground storage vessel, 
even under pressure, is almost negligible. 
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SECTION II 

PHILOSOPHY OF INSTRUMENTATION 


Concepts for monitoring toxicants cannot be detached from overall system requirements 
and constraints. The chronology of system development using state-of-the-art techniques 
includes: (1) hazard recognition, (2) identification of system requirements, (3) preliminary 
hardware testing and evaluation, (4) specifications and hardware procurement, and (5) hard- 
ware improvement and/or modification. 

Hazards must be recognized at the appropriate management organizational level to 
critically evaluate and justify action. Not only is high level management approval necessary 
to justify the high cost of toxic monitoring and control systems, but considerable engineering 
effort is also required, early in the program, to determine technical feasibility. 

Two important decisions must be made during the requirements identification period: 

(1) Should area or point detection be used? (2) Should displays be local or remote? 

The safety policy at the John F. Kennedy Space Center is that area detection be used 
in the blockhouse air-conditioning systems, unpressurized control buildings, test cells, and 
spacecraft white rooms; and that point detection be used when considerable personnel activity 
will take place around highly pressurized or fragile equipment. In such instances, sensors 
should be mounted directly on pipes or valves. 

It is recommended that data be transmitted and visually displayed at a central control 
point such as the control room or blockhouse, with a direct communication link to an audible 
warning system. This philosophy is consistent with the concept of removing personnel from 
possible hazards. For passive GSE at a support facility, a duplicate display, slaved to the 
unit at the primary control point, may be located in the secondary facility control center. 
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SECTION III 

TOXIC GAS MONITORING SYSTEM REQUIREMENTS 


A. GENERAL 

A monitoring system collects information on the cause and effects of a spill or leak 
but does not control the resulting hazards. Point detectors measure the causes; area 
detectors determine effects/ such as gas concentration. When a Red condition is detected, 
the decision to ignore the malfunction (if noncritical), evacuate the site, or initiate 
countermeasures must be made. Countermeasures can be: inerting purges, switching to 
alternate systems, offloading propellants, depressurizing, activating suppression systems, 
etc. It is important to note that the decision to override or countermeasure the malfunction 
rests jointly with the chief test conductor and the pad safety supervisor, not with the hazard 
monitoring system operators. The cause-effect -decision-control relationships are shown 
in Figure 1. For Apollo/Saturn V, an active monitoring system is required from T-180 
hours to T+24 hours to support the prelaunch countdown and deservicing in the event of a 
mission scrub. Hazardous conditions are not uniformly severe during this 204-hour 
period. The variable criticality of operations fora nominal Apollo mission is shown in 
Figure 2. 

The installation and checkout time required for activation is also a variable item. 
Communication and display installation may precede launch by several months, while 
sensors and transducers are installed and system calibration is conducted about 1 week be- 
fore activation. 

B. SYSTEM COMPONENTS 

To meet automated launch system requirements, a toxic gas monitoring system will 
consist essentially of three basic subsystems as shown following and in Figure 3. These 
subsystems are explained in detail in succeeding sections. 

1. Data Collection Subsystems 

Sensors and Transducers 

Amplifiers and Contact Meters or Switches 

Alarm Relays and Circuits 

2. Data Transmission Subsystem 

Oscillators and Coders (Frequency Shift Keying) 

Transmission Hardlines 
Decoders 
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FIGURE 2. NOMINAL PRELAUNCH SEQUENCE, APOLLO/SATURN V, LAUNCH COMPLEX 39 




FIGURE 3. MONITORING SUBSYSTEM LOGIC 


3. Data Display Consoles 

Subsidiary Operations Display 
Operations Safety Display 

C. THE SYSTEM LIFE CYCLE 

The life cycle of a monitoring system extends from activation of equipment through 
test, operation, termination, deactivation, maintenance, and refurbishment. Reliability 
is paramount during activation and testing, and durability is important during maintenance 
and refurbishment. 
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SECTION IV 

DATA COLLECTION SUBSYSTEMS 


A. GENERAL 

Sensors or transducers produce electrical pulses in the presence of toxic vapors. 
These pulses are usually in the millivolt or microvolt range and generally require amplifi- 
cation at the transducer. This will magnify and/or condition the signal for transmission. 
Transducers based on physical/chemical principles are most often used as point detectors 
In some instances, however, area or scanning devices such as ultrasonic microphones and 
long path infrared techniques have been used. Ideally, gas sensors should meet the speci 
fications shown in Table 1. 


TABLE I 

SENSOR SPECIFICATIONS 


Primary Consideration 
Configuration 
Operating Environment 

Range of Sensitivity 

Response Time to 90 Percent Full 
Scale 

Recovery Time to 10 Percent of 
Peak 

Zero Drift 


Specification 

Small, simple, and rugged 

Capable of withstanding noise, vibra- 
tion, humidity*and thermal stresses 
120 to 160 db at 20 cps 
40 to 100 percent relative humidity 
-40 to 140°F 

Response between 

IX to 100X TLV* low range 

100X to 1000X TLV high range 


Approximately 60 seconds 


Approximate ' 70 seconds 

Less than ± 3.5X TLV 

over 9-day period in the absence 

of shock or vibration 


^Threshold Limit Value 
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TABLE I (Continued) 


SENSOR SPECIFICATIONS 


Primary Consideration 
Fail-Safe Features 

Secondary Consideration 
Operation Principle 
Lower Sensitivity 
Specificity of Fuel Detectors 
Specificity of Oxidizer Detectors 
Orientation 
Electrical Output 

Electrical Input 
Accuracy 


Specification 

Local and remote circuit check 
capability 

Local and remote alarm capability 
Specification 
Physical or chemical 
0.5X TLV 

50:1 versus other fuels and solvents 

50:1 versus other oxidizers 

Independent of position 

Analog dc/convertible to 
digital dc 

None or llOv ac 

± 25 percent at full scale 


B. SENSORS AND DETECTORS 

Table 2 shows a partial list of sensors and detectors that can be packaged to meet 
NASA specifications. It is desirable that the transducer perform when overloaded with- 
out automatically cutting off or switching, and that the output signal remain at maximum 
when swamped. Transducers may be packaged with or without integral prime movers. 
KSC policy dictates that air pumps be eliminated where possible. When sensors are re- 
quired in air-conditioning ducts or closed spaces, natural diffusion will carry gases to 
the sensors, thereby eliminating air pumps. However, in applications subject to wind 
gusts, accurate air or gas samples cannot be obtained without an air pump. 
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TABLE 2. SENSORS AND DETECTORS 
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Most transducers produce an analog direct current signal proportional to incident 
gas concentration. Instrumentation used both locally and remotely, should have appropriate 
amplification to enable the transducer to drive a contact meter. The meter then provides a 
local visual analog reading and switching to trigger local internal or remote relays. For 
instrumentation used remotely, only a variable threshold go/no-go output is required thus 
eliminating transmission of analog signals over long wires. Such remote detectors actuate 
alarm relays at the control point and must certify go before unprotected personnel are 
allowed back into hazardous areas. 
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SECTION V 

THE ACTUAL NETWORK 


A. SENSOR LOCATION 

The network is best understood by looking at typical sensor subsystems. Figure 4 
depicts the toxic leak detection subsystem proposed for the Saturn V mobile service 
Structure (MSS). For semiremote operations from the base of the MSS, data and control 
signals can be transmitted over hardlines without amplifiers or repeaters external to the 
sensors. In this case, the control point is only 350 feet from the furthest detector. The 
oxygen depletion subsystems for the mobile launcher (ML) and the pad terminal connect- - 
mg rooms (PTCR) are somewhat simpler than the toxic leak detection subsystem (Figure 5) 
for the MSS . The oxygen detectors are passive and rely on the closed circuit air-condi- 
tioning system to move adequate air past the sensors to measure gas concentrations. In 
these applications/the detectors are located at or in the air return ducts. 

B. NUMBER OF SENSORS 

The toxic gas detection subsystem will require approximately 15 sensors per launch 
pad. Five of these sensors will be located at the upper level valve boxes and ten will be 
located at the conditioning service units. The oxygen depletion subsystems will consist 
of approximately nine sensors per pad; six in the base of the ML and three in the PTCR. 

C. DATA TRANSMISSION 

For remote operation, the signals from the detectors at the launch pad must be trans- 
mitted 3-1/2 miles to the Launch Control Center (LCC). This digital data relay and test 
command transmission is accomplished by a technique similar to high speed telegraphy. 
This technique is called frequency shift keying (FSK). FSK is a digital modulation 
technique wherein opening or closing a contact causes a discrete frequency shift of a 
carrier wave between two predetermined values. Each data or command channel is binary 
coded within a 20-bit segment of the carrier signal . Thus, with a scan rate of 800 bits 
per second, 40 digital information channels may be transmitted over a single narrow band 
telephone pair. A diagram of this FSK data transmission system is shown in Figure 6. 

D. DATA DISPLAYS 

The decoded signals are displayed visually and audibly in the LCC . The transmitted 
data are displayed on logic panels in appropriate operations consoles located on the second 
floor of the LCC, (Figure 7). When a leak is indicated by a no-go red light on this 
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UPPER LEVEL VALVE BOXES i LOWER LEVEL SERVICE UNITS 
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FIGURE 4 PROPOSED TOXIC LEAK DETECTION SUBSYSTEM FOR SATURN V 

MOBILE SERVICE STRUCTURE 
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FIGURE 6. FREQUENCY SHIFT KEYING DIGITAL DATA TRANSMISSION SYSTEM 




LAUNCH CONTROL CENTER 







subsidiary operations console, the operator presses the confirm indicator. This sends a 
command signal back over the digital transmission system, which initiates an amplifier 
continuity test at the MSS. If the sensor output amplifier is functioning properly, a 
second red light will confirm the propellant leak. The operator will then attempt to verify 
the extent of the malfunction by focusing the operational television system on the indicated 
trouble spot. Simultaneous with this confirmation and verification, the pad safety super- 
visor in the vehicle firing room is advised of the suspected malfunction by a signal on his 
summary display. 

Toxic gas and oxygen depletion functions are only two of the many summary functions 
displayed on this Operations Safety Console (see figure 8). The Operations Safety Console 
is at all times visible to the test supervisor and advises him of the overall safety status 
of launch pad personnel . 
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FIGURE 9. OPERATIONS SAFETY ST~ , 


JS CONSOLE 
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FIGURE 10. OPERATIONS SAFETY DISPLAY CONSOLE 
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APPENDIX 

ABBREVIATIONS 


APS 

Auxiliary propulsion system 

CM 

Command module 

CM/SM 

Command module/service module 

HMS 

Hazardous monitoring system 

LEM 

Lunar excursion module 

RCS 

Reaction control system 

SPS 

Space propulsion system 
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